Is Video Downloader Pro safe?

High risk

Video Downloader Pro is high risk. On Facebook, Video Downloader Pro reads the `fb_dtsg_ag` anti-CSRF token from outbound requests, saves it locally, then reuses it to call Facebook's video data endpoint with your user ID. Testing found the token in storage after a visit.

Videoload-pro.comv1.9.1Chrome Web Store
75Risk

AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.

Publishers can request a review.

Findings

Facebook CSRF Token Captured and Stored by Video Downloader Pro

On Facebook, Video Downloader Pro reads the `fb_dtsg_ag` anti-CSRF token from outbound requests, saves it locally, then reuses it to call Facebook's video data endpoint with your user ID.

Testing found the token in storage after a visit.

Severity
High unwanted
Type
Unexpected
CWE
CWE-522
Source
Dynamic sandbox
What actually happens
You did this

You visit Facebook and your browser makes any request to facebook.com/ajax/* or facebook.com/video/video_data_async/.

This includes normal background activity triggered by loading the Facebook page; you do not need to click anything.

The extension did this

The extension reads the `fb_dtsg_ag` anti-CSRF token from the outbound request URL and saves it to its own local storage.

The token is later used by the extension's content script to make authenticated Facebook API calls on your behalf.

What's stored on your device

The token testing saw stored after visiting Facebook: a session credential Facebook's front-end uses to authorise requests and block CSRF.

Location
chrome.storage.local key 'currentFb_dtsgToken'
Contents
{  "currentFb_dtsgToken": "Ad2yvzFAoziFqCdZzkFqX3hzihJuDwO0jt_hpdmA4FBIE9dI:49:1776479026"}
The code that does this

worker.js, service worker that intercepts and stores the token

Readable version
// Registered immediately when the service worker starts.// Watches every outbound request your browser makes to Facebook's AJAX and video endpoints.chrome.webRequest.onSendHeaders.addListener(  (requestDetails) => {    // Read the fb_dtsg_ag CSRF token from the request's query string.    const token = new URL(requestDetails.url).searchParams.get('fb_dtsg_ag');    if (token) {      // Skip if we already have this exact token (de-duplication).      if (this.dtsgToken === token) return;      // Store the new token both in memory and in persistent extension storage.      this.dtsgToken = token;      chrome.storage.local.set({ currentFb_dtsgToken: token });    }  },  {    // Applies to all requests to these two Facebook endpoint patterns.    urls: [      '*://*.facebook.com/video/video_data_async/*',      '*://*.facebook.com/ajax/*'    ]  },  ['requestHeaders']);
The code that does this

fbHelper.js, content script that uses the stored token to call the Facebook API

Readable version
async searchVideoInfo(videoId) {  // Retrieve the captured CSRF token from storage if not already in memory.  if (!this.dtsgToken) {    await this.getDtsgToken(); // sends message to service worker, which reads chrome.storage.local  }  const token = this.dtsgToken;  if (!token) return; // abort if no token available  // Also read the c_user cookie — Facebook's numeric user ID for the logged-in account.  const userId = this.getCookie('c_user');  // Make an authenticated API call to Facebook's internal video data endpoint,  // passing both the CSRF token and the user ID as query parameters.  const response = await fetch(    `https://www.facebook.com/video/video_data_async/` +    `?video_id=${videoId}` +    `&fb_dtsg_ag=${token}` +   // the captured CSRF token    `&__user=${userId}` +       // your Facebook numeric user ID    `&__a=1`,    { signal: this.controller.signal }  );  const text = await response.text();  const data = JSON.parse(text.replace('for (;;);', ''));  // ... extracts hd_src / sd_src video download URLs from the response}
Parameters sent in the extension's authenticated Facebook API call
  • Facebook CSRF token (fb_dtsg_ag)
    Ad2yvzFAoziFqCdZzkFqX3hzihJuDwO0jt_hpdmA4FBIE9dI:49:1776479026

    A session credential Facebook's front-end uses to authorise API requests. The extension captures it from outbound traffic and reuses it.

  • Your Facebook user ID (__user / c_user)
    100072841930518

    Your numeric Facebook account ID, read directly from the c_user cookie. Uniquely identifies your account.

  • Video ID
    10217498302938471

    The ID of the Facebook video being looked up. Determines what content the API call retrieves.

Check if you're affected

Run this in Chrome DevTools on any Facebook page with Video Downloader Pro installed. It reads chrome.storage.local and reports whether the extension has captured and stored your Facebook CSRF token.

Requires
  • Chrome with Developer mode enabled
  • Video Downloader Pro extension installed
  • A logged-in Facebook session
check-fb-token.js · js
// check-fb-token.js// Paste into Chrome DevTools console while on a Facebook page.// Reports whether Video Downloader Pro has stored your fb_dtsg_ag CSRF token.(async () => {  // The extension stores the token under this key.  const KEY = 'currentFb_dtsgToken';  // Query the extension's local storage via the background service worker.  // This only works if you have access to the extension's DevTools context  // (open chrome://extensions, click the service worker link for Video Downloader Pro).  chrome.storage.local.get(KEY, (result) => {    const token = result[KEY];    if (token) {      console.log('[VIDEO-DL-PRO] fb_dtsg_ag token IS stored:', token);      // Parse the token to show the embedded timestamp.      const parts = token.split(':');      if (parts.length === 3) {        const ts = parseInt(parts[2], 10);        console.log('[VIDEO-DL-PRO] Token timestamp:', new Date(ts * 1000).toISOString());      }    } else {      console.log('[VIDEO-DL-PRO] No fb_dtsg_ag token found in storage yet.');      console.log('  Try loading a Facebook page and checking again.');    }  });})();
How to run it
  1. 1Install Video Downloader Pro.
  2. 2In chrome://extensions, find it, click the service worker link.
  3. 3Paste this script into the console.
  4. 4Output shows whether your fb_dtsg_ag token was captured.

What it can do

Permissions this extension asks for, as declared in version 1.9.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.

  • Read and change your data on every site you visit

    <all_urls>

  • Start, monitor and manage your downloads

    downloads

  • Store data in your browser

    storage

  • Watch every request your browser makes

    webRequest

  • See the address and title of every tab you have open

    tabs

  • Run its own code inside the pages you visit

    scripting

Updated 30 September 2026hebjaboacandjnlnhocfikmaghgbfjlp